Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!ames!elroy!hacgate!ashtate!dbase!garyc
From: garyc@dbase.UUCP (Gary Carter)
Newsgroups: comp.sys.ibm.pc
Subject: Re: New? Virus
Message-ID: <48@dbase.UUCP>
Date: 9 Apr 89 05:59:23 GMT
References: <11758@louie.udel.EDU> <47106@linus.UUCP>
Reply-To: garyc@alexis.UUCP (Gary Carter)
Organization: Ashton-Tate, Walnut Creek, CA
Lines: 10

In article <47106@linus.UUCP> jcmorris@mbunix (Morris) writes:
>In article <11758@louie.udel.EDU> davis@udel.EDU (Michael Davis) writes:
>>Has anyone ran across a "virus" that consists of a hidden dir called INDEX
>>that has subdirectories named DELETED containing still, files call
>>DELETED.xxx where xxx are hex numbers?  

The Microsoft Editor supplied with their C compiler and assembler products
(runs on both DOS and OS/2) creates a hidden DELETED directory with INDEX
and DELETED.xxx in it which are backups of edited files.  These can be
listed and recovered using the undel.exe program that comes with it.